add support for users in nested OUs by allowing the user DN (distinguishedName) to be looked up, rather than pre-configured